CVE-2026-71193

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71193", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-05T05:09:31.046Z", "datePublished": "2026-08-12T22:17:12.516Z", "dateUpdated": "2026-08-13T13:35:19.251Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Designate", "repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.2", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-12T22:17:12.516Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2160533"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-034.html"}, {"tags": ["vendor-advisory", "mailing-list"], "url": "https://www.openwall.com/lists/oss-security/2026/08/11/6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "20.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "21.0.0", "versionEndExcluding": "21.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.0.0", "versionEndExcluding": "22.0.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:33:33.269958Z", "id": "CVE-2026-71193", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:35:19.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:33:33.269958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:35:10.650Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "product": "Designate", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "20.0.2", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "lessThan": "21.0.1", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "lessThan": "22.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2160533", "tags": ["issue-tracking"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-034.html", "tags": ["vendor-advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/11/6", "tags": ["vendor-advisory", "mailing-list"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "20.0.2", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.0.1", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.0.1", "versionStartIncluding": "22.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-12T22:17:12.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71193", "state": "PUBLISHED", "dateUpdated": "2026-08-13T13:35:19.251Z", "dateReserved": "2026-08-05T05:09:31.046Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-12T22:17:12.516Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Designate", "repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.2", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering."}, {"lang": "es", "value": "En OpenStack Designate antes de 22.0.1, las comprobaciones de creaci\u00f3n de zonas (_is_subzone, _is_superzone, y la restricci\u00f3n de base de datos de zona duplicada) est\u00e1n limitadas solo al pool de destino. Un usuario autenticado puede eludir estas comprobaciones programando una zona a un pool diferente a trav\u00e9s del planificador AttributeFilter, creando una zona superpuesta que entra en conflicto con la zona de otro inquilino. Esto permite el secuestro de DNS entre inquilinos (redirigiendo el tr\u00e1fico a IPs controladas por el atacante) y la denegaci\u00f3n de servicio de DNS (respuestas NODATA). La explotaci\u00f3n requiere una implementaci\u00f3n de m\u00faltiples pools con AttributeFilter habilitado en scheduler_filters, lo cual es una configuraci\u00f3n no predeterminada pero documentada y soportada para la estratificaci\u00f3n de autoservicio."}], "id": "CVE-2026-71193", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71193", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:33:33.269958Z", "version": "2.0.3"}}]}, "published": "2026-08-12T23:17:22.030", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2160533"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-034.html"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/08/11/6"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Omer Schwartz (Red Hat) and Tore Anderson (Redpill Linpro AS) as the original reporters.", "bugzilla": {"description": "openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler", "id": "2510947", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510947"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool. The database uniqueness constraint on zone names is pool-scoped, and the subzone/superzone ownership checks in the Central service include pool_id in their query criteria, making them pool-scoped rather than global. This allows a tenant to create zones that overlap with another tenant's zones in a different pool, bypassing cross-tenant namespace isolation. Successful exploitation could lead to cross-tenant DNS zone overlap and subzone ownership bypass."], "mitigation": {"lang": "en:us", "value": "For deployments not using multi-pool DNS: verify that the 'scheduler_filters' configuration option in the [service:central] section only contains 'default_pool' (the default value). This prevents tenants from selecting alternative pools and eliminates the zone overlap vulnerability.\nFor deployments using multi-pool DNS: replace the 'attribute' filter with 'pool_id_attribute' in the 'scheduler_filters' configuration. The pool_id_attribute filter enforces the 'zone_create_forced_pool' policy check, which defaults to requiring the SYSTEM_ADMIN role, preventing regular tenants from choosing pools."}, "name": "CVE-2026-71193", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-11T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71193\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71193\nhttps://launchpad.net/bugs/2160533"], "statement": "Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions. Multipool deployments using the AttributeFilter scheduler were never a fully supported configuration in any RHOSP version. In RHOSP 13, 16.2, and 17.1 (TripleO deployment), the default scheduler_filters configuration is default_pool, which assigns all zones to a single pool and prevents the cross-tenant zone overlap.\nFor Red Hat OpenStack Services on OpenShift (RHOSO, openstack-18.0), the designate-operator hardcodes scheduler_filters to pool_id_attribute, in_doubt_default_pool in the central service configuration template. The pool_id_attribute filter enforces the zone_create_forced_pool policy check, which defaults to requiring the SYSTEM_ADMIN role, preventing regular tenants from selecting pools. Therefore, RHOSO is not affected in the default configuration. However, RHOSO becomes affected if an administrator uses the customServiceConfig field to set scheduler_filters to include the attribute filter, as customServiceConfig is a freeform string with no CRD validation or webhook filtering, written to a config-dir override that oslo.config loads with last-wins semantics, silently overriding the operator's safe default.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,20.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,21.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,22.0.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Designate", "source": "cna", "vendor": "OpenStack"}, "product": "designate", "vendor": "openstack"}], "created": "2026-08-12T23:15:03.357302+00:00", "title": "Cross\u2011Tenant DNS Hijack and Denial of Service via Designate Zone Creation", "updated": "2026-08-13T02:15:02.663757+00:00", "vendors": ["openstack", "openstack$PRODUCT$designate"]}